SesameOp: The New Backdoor Abusing OpenAI API for C2

Microsoft finds malware using the Assistants API for stealthy command and control. Learn how this espionage tactic works and how to mitigate it.

Nov 04, 2025

Beyond the Hype: How the “SesameOp” Backdoor Turns OpenAI into a Stealthy C2 Channel (And How to Fight Back)

In the cybersecurity world, we often talk about attackers “living off the land”—using a victim’s own internal tools (like PowerShell or WMI) to avoid detection. But what happens when they start “living off the trusted service“?

We’re now seeing the answer. Security researchers at Microsoft have uncovered a novel backdoor, dubbed “SesameOp,” that cleverly abuses the OpenAI Assistants API, not for generating text, but as a stealthy, encrypted command-and-control (C2) channel.

This discovery, detailed by both The Hacker News and SecurityWeek, marks a significant evolution in attacker tactics. It turns a universally trusted, high-reputation service into a covert tool for espionage.

Here’s a breakdown of how it works and, more importantly, how you can defend against this new class of threat.

How SesameOp Abuses a Trusted API

Microsoft’s Detection and Response Team (DART) first identified SesameOp in July 2025 during an incident response investigation. The attacker’s goal was clear: long-term, persistent access for espionage. The method, however, was anything but ordinary.

Instead of relying on a traditional C2 server—which can be easily identified, blocked by IP/domain, and blacklisted—the attackers built their C2 mechanism on top of OpenAI’s infrastructure.

Here’s the attack chain:

Initial Persistence: The attackers gain a foothold and utilize a technique known as AppDomainManager injection. This allows them to load a malicious .NET DLL (identified as “Netapi64.dll”) into a legitimate, compromised Visual Studio utility.
The Backdoor: This loader component then activates the main backdoor, a .NET-based implant (”OpenAIAgent.Netapi64”).
Covert C2 Communication: This is the brilliant (and nefarious) part. The backdoor doesn’t make suspicious calls to a malicious IP. Instead, it makes legitimate, HTTPS-encrypted API calls to api.openai.com.
- Fetching Commands: The malware uses the OpenAI Assistants API as a “dead drop” location. It queries the API to retrieve “instructions” left by the attacker, which are disguised as simple messages. These commands tell the backdoor to SLEEP (stay dormant), or execute a Payload (the main attack code).
- Exfiltrating Data: After the payload executes (e.g., running commands, stealing data), the backdoor sends the results back to the OpenAI API, posting it as a new message for the attacker to retrieve at their leisure.

As SecurityWeek notes, this allows the attacker to stealthily “orchestrate malicious activities” without ever exposing their own infrastructure. To a traditional firewall or network security tool, this appears as legitimate, encrypted traffic to a popular AI service—noise that is almost impossible to distinguish from legitimate developer activity.

Mitigating a Threat Hiding in Plain Sight

When attackers exploit a trusted service like OpenAI, simple IP or domain blocking is not a viable option. Doing so would break critical business functions. The defense, therefore, must be more intelligent and layered, focusing on behavior and context rather than just destinations.

Here are practical mitigating controls organizations should consider.

1. Enhance Network Monitoring and Egress Filtering

You can’t block OpenAI, but you can scrutinize who is talking to it.

Principle of Least Privilege: Your first question should be, “Which of our assets need to talk to the OpenAI API?” Developers’ workstations? Plausible. A production web server? Maybe. A domain controller or a finance team’s file server? Almost certainly not.
Context-Aware Egress Rules: Implement egress filtering that restricts API-level access to only authorized users and servers. If a server that has no business using AI suddenly starts making persistent connections to api.openai.com This is a massive red flag.
Analyze Traffic Volume: Look for anomalies in traffic patterns. A developer might make sporadic API calls. A backdoor, on the other hand, will likely make highly regular, “heartbeat” connections as it checks in for new commands. Monitor for this low-and-slow, periodic beaconing.

2. Leverage Endpoint Detection and Response (EDR)

The network traffic may be stealthy, but the activity on the endpoint is not. This is where the attacker gives themselves away.

Detect the Root Cause: An EDR solution should be configured to detect the initial persistence mechanism. Techniques like AppDomainManager injection are highly suspicious and a strong indicator of compromise (IOC).
Monitor Process Behavior: The backdoor (e.g., “OpenAIAgent.Netapi64”) has to run from somewhere. Monitor for legitimate, signed processes (like a Visual Studio utility) spawning unusual child processes (like cmd.exe or powershell.exe) or making unexpected network connections to AI services. This is a classic sign of an implant.

3. Secure and Audit API Keys

This specific attack used an API key and an account controlled by the adversary. However, it highlights a critical new attack surface: your own organization’s API keys.

API Key Inventory: You must know the location of all your corporate OpenAI (and other) API keys. Who has access to them? Where are they stored?
Monitor Key Usage: Use the platform’s own monitoring tools. If an API key experiences a sudden surge in usage (or cost) or its usage patterns change (e.g., it is now being used from a new geographical location), this could signal a compromise.
Provider Collaboration: As both articles note, Microsoft shared its findings with OpenAI, which promptly disabled the malicious account and API key. This highlights the need for a strong reporting relationship with your critical SaaS and PaaS vendors.

4. Implement User and Entity Behavior Analytics (UEBA)

This threat is a perfect use case for UEBA. These systems create a baseline of “normal” activity for every user and asset in your network. The backdoor’s behavior is, by definition, an anomaly. A UEBA platform would automatically flag activity like:

A user account that normally works 9-to-5 suddenly shows API activity at 3:00 AM.
A server that only communicates with other internal servers suddenly reaches out to an external AI service.

The New Frontier

SesameOp is a blueprint. We should assume that this technique is already being replicated to abuse other trusted, high-volume services—be it cloud storage, code repositories, or messaging platforms.

Our security posture must evolve from a simple “allow” or “deny” model to one that is based on zero-trust principles, capable of asking: “I trust this service, but do I trust why and how it’s being used right now?”

Thanks for reading SMB Tech & Cybersecurity Leadership Newsletter! If you gained value from this post, why not share it with others who can learn from it as well?

Some security tools you can consider for improving your business security posture:

Airia’s Enterprise AI Orchestration Platform delivers comprehensive security controls that protect your data, ensure compliance, and maintain enterprise governance throughout your AI journey. Deploy with confidence knowing your AI initiatives are protected by industry-leading security architecture. https://try.airia.com/CPF-coaching
Tenable provides the industry’s most comprehensive vulnerability management platform, empowering security teams to see and secure their entire attack surface—from on-prem to cloud and code. This unified solution illuminates hidden weaknesses and contextualizes risk, allowing you to prioritize threats and act decisively to protect your complete infrastructure. https://shop.tenable.com/cpf-coaching
Omnistruct provides the strategic expertise to build and scale your privacy, GRC, and security programs, empowering your team to achieve its goals without sacrificing compliance. By serving as your embedded security partner (BISO), Omnistruct delivers the executive-level guidance and hands-on support needed to mature your security posture and align it with your core business objectives. https://omnistruct.com/partners/influencers-meet-omnistruct/

CrowdStrike Falcon is the definitive AI-native platform built to stop breaches, empowering organizations to secure their entire infrastructure at scale. This end-to-end solution unifies endpoint, cloud, and identity protection, leveraging world-class threat intelligence to keep you decisively ahead of modern, AI-powered attacks. https://crowdstrike2001.partnerlinks.io/Cpf-coaching

INE Security Awareness and Training transforms your workforce into a powerful line of defense, empowering your teams to navigate the evolving threat landscape with confidence. This essential program moves beyond mere compliance, embedding deep security consciousness to measurably reduce human-activated risk and enhance your organization’s total defensive posture. https://get.ine.com/cpf-coaching

Cyvatar.AI delivers an enterprise-grade, managed endpoint protection solution specifically designed to empower SMBs in the digital and cloud era. This affordable, AI-driven platform provides continuous monitoring and response without the cost or complexity of an in-house team, allowing you to focus on your business while we secure your assets. https://cyvataraif5706.referralrock.com/l/CHRISTOPHE77/

Guidde is the AI-powered platform that transforms your team’s undocumented “tribal knowledge” into stunning, easy-to-follow video tutorials and step-by-step instructions. This solution empowers you to capture any process in seconds, drastically reducing training time, eliminating repetitive questions, and ensuring operational consistency across your organization. https://affiliate.guidde.com/cpf-coaching

Cyberupgrade simplifies and accelerates your cyber and digital risk management, empowering you to grow your business without becoming a compliance expert. This intuitive platform abstracts away the complexities of frameworks like DORA, ISO 27001, and NIS2, freeing your team to concentrate on building, scaling, and serving your customers. https://join.cyberupgrade.net/cpf-coaching

1Password provides the industry’s most trusted solution for securing all your secrets, empowering individuals and businesses to protect their most sensitive data. This intuitive platform seamlessly manages passwords, tokens, documents, and credentials, offering a single, secure vault for your entire digital life, whether you’re at home, at work, or on the go. https://1password.partnerlinks.io/cpf-coaching

BLACKBOX AI is the world’s most advanced AI coding ecosystem, empowering developers at every level to build, debug, and deploy software 10x faster across any platform. This complete, end-to-end solution transforms ideas into reality by seamlessly integrating over 300 AI models directly into your workflow, from the web to your IDE. https://blackboxai.partnerlinks.io/cpf-coaching